A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to address this issue.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4593 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4593-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Jochen Sprickerhof     May 21, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : openjpeg2     Version        : 2.4.0-3+deb11u3     CVE ID         : CVE-2026-6192

    A vulnerability was identified in uclouvain. This impacts the function     opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The manipulation     leads to integer overflow. The attack must be carried out locally.

    For Debian 11 bullseye, this problem has been fixed in version     2.4.0-3+deb11u3.

    We recommend that you upgrade your openjpeg2 packages.

    For the detailed security status of openjpeg2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openjpeg2

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6277 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6277-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 15, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : openjpeg2     CVE ID         : CVE-2026-6192

    An integer overflow has been discovered in OpenJPEG, a JPEG 2000 image     compression/decompression library, which could result in denial of     service or potentially the execution of arbitrary code if malformed     images are opened.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 2.5.0-2+deb12u3.

    For the stable distribution (trixie), this problem has been fixed in     version 2.5.3-2.1~deb13u2.

    We recommend that you upgrade your openjpeg2 packages.

    For the detailed security status of openjpeg2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openjpeg2

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8252-1 advisory.

    It was discovered that OpenJPEG did not properly handle memory when encoding image files. An attacker     could use this issue to cause OpenJPEG to crash, resulting in a denial of service, or possibly execute     arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function     opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow.
    The attack must be carried out locally. The exploit is publicly available and might be used. The     identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to     address this issue. (CVE-2026-6192)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
316379	Debian dla-4593 : libopenjp2-7 - security update	Nessus	Debian Local Security Checks	medium
314995	Debian dsa-6277 : libopenjp2-7 - security update	Nessus	Debian Local Security Checks	medium
314210	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenJPEG vulnerability (USN-8252-1)	Nessus	Ubuntu Local Security Checks	medium
306242	Linux Distros Unpatched Vulnerability : CVE-2026-6192	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-6192

medium

Tenable Plugins

medium

medium

medium

medium